The UK's right-to-work regime is about to change in a way that will affect far more organisations than many realise. From 1 October 2026, compliance obligations will extend well beyond traditional employees, reaching contractors, agency workers, platform-based workers and complex supply chains. For businesses that engage labour in any of these ways, now is the time to act.
In brief
- A wider definition of "employment" brings workers' contracts, individual subcontractors within contracting chains, and online matching platforms within scope of the illegal working regime for the first time.
- Liability now travels up the supply chain: where a worker at the bottom of a subcontracting chain lacks the right to work, every business in that chain may be exposed to civil penalties, even without a direct contractual relationship with the worker.
- A new extended statutory excuse is available but demands significant compliance effort: businesses must have the right contractual terms, substitution controls, and identity verification systems in place before any work begins. Failing to meet even one prescribed requirement may leave the business without a defence.
- Digital verification providers must now be specifically authorised for right to work checks on the Office for Digital Identities and Attributes register — general identity verification authorisation alone is not sufficient.
- This is no longer just an HR issue: procurement, legal, operations, and supply chain functions all carry direct compliance implications and must be engaged in a coordinated response ahead of 1 October 2026.
The background
The starting point remains unchanged: under section 15 of the Immigration, Asylum and Nationality Act 2006, it is unlawful to employ someone in the UK who does not have the right to work here. If an employer conducts a compliant right to work check and that check is properly carried out, they will obtain a statutory excuse. This means that if it later transpires that the worker did not have the right to work, the employer cannot be penalised, provided the check was done correctly.
What has changed is not that core principle, but rather who it applies to.
Section 48 of the Border Security, Asylum and Immigration Act 2025 significantly expands the categories of working arrangement caught by the illegal working regime, extending beyond traditional employee-employer relationships.
This provision will come into force on 1 October 2026. An updated draft Employers' guide to conducting right to work checks was published on 16 July 2026 to help employers and businesses comply with the new requirements in practice.
In short: the rules as to what constitutes a compliant check remain broadly the same, but the universe of businesses required to conduct those checks - and exposed to liability if they do not - has grown considerably.
What is changing
A wider definition of "employment"
From 1 October 2026, the scope of 'employers' who may be subject to an illegal working penalty will be expanded to include not only those who employ an individual under a contract of employment, but also those who:
- Engage an individual under a 'worker's contract': these cover individuals providing work or services to a business under a contract that does not amount to a contract of employment but nonetheless involves a degree of personal service and subordination to the engaging party. Genuinely self-employed professionals who contract directly with their own clients fall outside of this category. The distinction is important, as it is the nature of the relationship, not the label applied to it, that determines which category applies.
- Engage an 'individual subcontractor' within a contracting chain: where an individual is engaged as part of a chain of contracts, with each party having been contracted by another to deliver the same or related work or services. In practical terms, this means that where a business engages a subcontractor, and that subcontractor in turn engages its own subcontractors, the business at the top of the chain may be exposed to liability in respect of a worker at the bottom of that chain, even where no direct contractual relationship exists between them. This may be problematic to apply in practice, and businesses should review supply chains and procurement processes and seek advice where required.
- Operate an 'online matching service: businesses that connect individual service providers with clients or customers, including gig economy platforms, will now be treated as employers for these purposes. This extends to any substitutes the service provider is permitted to use under their arrangements.
Who is not in scope
Genuinely independent self-employed professionals who contract directly with their own clients, without any supply chain, platform, or intermediary involvement, are generally outside the scope of the new regime, provided the arrangement is correctly classified and is truly arm's-length in nature. Importantly, a business that simply purchases services from such a provider does not, by virtue of that transaction alone, become liable under the extended regime.
The word "genuinely" is significant here. The classification of a working arrangement will be scrutinised on its actual characteristics, not merely on how it is labelled. An arrangement described as independent self-employment but which in practice exhibits the features of a worker's contract or subcontracting arrangement may fall within scope regardless of the label applied to it.
Liability travelling up the supply chain
This is arguably the most consequential change. Under the existing rules, civil penalty liability for illegal working is tied to the business with the direct employment relationship. The new rule breaks that link. In practical terms, this means:
- In a subcontracting chain, if Company A subcontracts work to Company B and Company B's workers do not have the right to work, both Company A and Company B may be liable. This will also extend further down the chain to Companies C, D, and E. No business in the chain is automatically insulated simply because it does not directly employ the workers.
- Where an online matching platform (Company A) connects a service provider (Company B) with a client, both the platform and the service provider may face liability if Company B's workers lack the right to work.
- In substitution arrangements, if a worker is replaced by a substitute under a contract that permits substitution, the engaging business may be liable for that substitute's right to work, even if it has no direct contractual relationship with the substitute at all.
The draft Employers' guide indicates that extended liability is most likely to be triggered where the Home Office cannot identify the business that has a direct contractual relationship with the worker in question. However, the practical effect is that every business within the chain remains exposed so long as that party cannot be identified. This places a significant premium on contractual due diligence and supply chain visibility.
Establishing a statutory excuse under the new rules
The existing statutory excuse framework remains in place for businesses that directly employ workers in the traditional sense. Provided a compliant right to work check is carried out before employment commences, the employer will have a statutory excuse against any civil penalty if it later emerges that the worker did not have the right to work.
For the new categories of arrangement caught by the extended liability provisions, such as subcontracting chains, substitution arrangements, and online matching platforms, a separate statutory excuse is available. However, it is important to understand that this excuse is not automatic. It is available only where a business satisfies all of the prescribed requirements set out below, and those requirements must be met before work begins. Failing to meet even one of them may leave the business without a defence to a civil penalty.
The three areas in which prescribed requirements must be satisfied are as follows:
- Contractual terms: Before work commences, a written agreement must be in place between the parties. This agreement must incorporate five mandatory provisions. In broad terms, these require the other party to carry out right to work checks, prohibit further subcontracting without prior written consent, and ensure that equivalent right to work obligations flow down through any permitted subcontracting arrangements. The intent is to ensure that compliance obligations do not fall away as work passes further down a contracting chain.
- Substitution controls: Where a contract permits substitution, that is, where one worker may be replaced by another to carry out the same work, several mandatory process requirements must be implemented before any substitution takes place. They include ensuring that a (i) right to work check is conducted for any substitute worker, (ii) that the responsibility for carrying out those checks cannot be passed to the workers themselves, and that (iii) no substitute may begin work until their right to work has been positively verified.
- Identity verification: Businesses must have proportionate systems in place to ensure that the individual who carries out the work is the same person whose right to work was checked. This is designed to prevent scenarios where checks are conducted on one individual, but the work is performed by another. The draft Employers' guide identifies five acceptable methods, including identity cards, workplace access passes, facial verification technology, use of registered digital verification service providers, and periodic re-verification of identity at set intervals.
The new extended statutory excuse is a meaningful protection, but it comes with a significant compliance burden. Businesses must have the right contracts, the right processes, and the right verification systems in place, all before any work starts.
Digital checks: new requirements
Where a business uses a digital verification service provider to conduct right to work checks, and wishes to rely on those checks to establish or maintain a statutory excuse, it must, from 1 October 2026, ensure that the provider it uses meets two distinct requirements:
- The provider must be registered on the Office for Digital Identities and Attributes register; and
- The provider must be specifically authorised for right to work checks, not merely authorised for general identity verification purposes.
The distinction between the two is important. A provider may be registered on the register and authorised to carry out identity checks in a broader sense, but that alone will not be sufficient. The authorisation must extend specifically to right to work purposes. Businesses that currently use a digital verification provider should therefore confirm - with that provider directly if necessary - that their authorisation covers right to work checks specifically. If it does not, arrangements to switch to a compliant provider should be made before 1 October 2026 (It is worth noting that many background-checking organisations subcontract the digital verification function to a registered and authorised provider, so the position may not always be immediately apparent from the existing contractual arrangements).
In a welcome and practical development, British and Irish passports (and Irish passport cards) will now be accepted for digital identity verification checks up to six months past their expiry date.
Penalties
The civil penalty framework remains in place and continues to carry significant financial consequences. A business found to have employed a worker without the right to work may face a penalty of up to £60,000 per illegal worker. For businesses that have previously been penalised and have failed to remediate, repeat breaches may attract even higher penalties. Conducting a compliant right to work check and being able to demonstrate that it was carried out correctly, provides a statutory excuse and protects the business against such a penalty, even if it later transpires that the worker did not in fact have the right to work.
Beyond civil penalties, criminal liability may arise where there is reasonable cause to believe that a business knew, or had reasonable grounds to believe, that illegal working was taking place. This is a higher threshold than mere non-compliance, but the consequences are considerably more severe. Criminal liability can result in unlimited fines and, for individuals within the business, such as directors, managers, or those with oversight responsibility, the risk of custodial sentences. This means that personal liability for senior individuals is a real consideration, not merely a theoretical one.
Why this is no longer just an HR issue
Perhaps the most important message to take from the breadth of these changes is that immigration compliance can no longer be treated as the sole responsibility of the HR function. The extension of the regime means that the decisions made by procurement when selecting suppliers, by operations when structuring labour supply, by legal when drafting contracts, and by supply chain teams when managing contracting arrangements all carry direct compliance implications.
Each of those functions now has a role to play in ensuring the organisation is protected. Businesses that continue to treat right to work compliance as an HR administrative task, without engaging the wider organisation, are likely to find themselves exposed, particularly in complex supply chain arrangements where the risk of extended liability is greatest.
Next steps
We recommend the following steps to ensure that your company is prepared ahead of the change's introduction:
- Conduct a 'census' i.e., identify all categories of workers engaged by the business, including employees, contractors, agency workers, subcontractors and platform workers. Compare these arrangements against the revised definitions in the Code of Practice to determine which relationships fall within the expanded regime and where liability may arise. This assessment will also inform subsequent policy updates and staff training.
- Review template agreements to include the contractual provisions needed to support a statutory excuse under the new rules, including where subcontracting, substitution or online matching arrangements apply. Existing contracts should also be reviewed to identify and manage potential compliance risks.
- Revise right to work policies and procedures before 1 October 2026 to reflect the new legal framework. Continuing to rely on existing policies after that date may expose the organisation to civil penalties.
- (if applicable) Check if digital identity service provider is registered on the Office for Digital Identities and Attributes register and authorised to carry out right-to-work checks. If checks are outsourced through a background screening provider, verify that any subcontracted verification services also meet these requirements.
- Train staff responsible for conducting right to work checks on the expanded scope of the regime, the new worker categories, and the requirements for establishing a statutory excuse.
- Review your procurement processes to determine whether third party vendors you engage with are compliant and/or will be able to assist you maintain compliance with the changes.
- Seek legal advice to review all the above for surety that you will be compliant.
The changes taking effect on 1 October 2026 require a coordinated response across procurement, legal, operations and HR functions. Compliance should be treated as an ongoing obligation rather than a one-time exercise, and organisations are advised to keep their arrangements under regular review as further guidance emerges.
Please note that this article is for general information purposes only. It cannot be relied upon and does not constitute legal advice.
For further information contact:
Roberta Imperial, Managing Associate, Business Immigration
Dean Joshua Oamen, Associate, Business Immigration